DORA Gap Analysis Template for UK Financial Firms
DORA entered into force on 17 January 2025, and the firms we speak to fall into two camps: those that have conducted a structured gap analysis and know exactly what work remains, and those that have broadly assessed their compliance and believe they are "mostly there". The gap between these two positions is where regulatory risk lives. A structured DORA gap analysis — systematically assessing your current state against each of DORA's five pillars — is the foundation of a credible compliance programme. This template provides the framework.
DORA in force January 2025. UK firms with EU operations or EU ICT providers are in scope. A structured gap analysis is the starting point for any credible compliance programme.
Pillar 1: ICT Risk Management Framework
DORA Articles 5–16 require a comprehensive ICT risk management framework. Key gap analysis questions:
- Do you have a Board-approved ICT risk management framework that is reviewed annually?
- Have you identified and documented your ICT assets — hardware, software, data, and third parties?
- Do you have a current ICT risk register with assessed, owned, and mitigated risks?
- Are your information security policies documented and approved by senior management?
- Do you have documented business continuity and disaster recovery plans for ICT systems?
- Gap indicator: If you cannot produce a current ICT risk register on request, Pillar 1 has material gaps
Pillar 2: ICT Incident Reporting
DORA Articles 17–23 require classification and reporting of major ICT incidents. Key gap analysis questions:
- Do you have a documented incident classification methodology that distinguishes major from non-major incidents using DORA's criteria?
- Do you have a procedure for notifying your lead EU regulator of major ICT incidents within DORA's timeframes (initial notification within 4 hours; intermediate report within 72 hours; final report within one month)?
- Do you maintain an incident register covering all ICT incidents regardless of classification?
- Gap indicator: If your incident response plan predates DORA and does not address DORA classification and reporting timelines, Pillar 2 has material gaps
Pillar 3: Digital Operational Resilience Testing
DORA Articles 24–27 require resilience testing proportionate to the firm's significance. Key gap analysis questions:
- Do you conduct annual basic resilience testing (vulnerability assessments, penetration testing, tabletop exercises)?
- If you are a significant entity, have you planned for TLPT (threat-led penetration testing)?
- Do you test scenarios that include cyber attack, third-party failure, and cloud outage?
- Are test results documented, gaps tracked, and remediation completed within agreed timelines?
- Gap indicator: If your last penetration test was more than 12 months ago, Pillar 3 has an immediate gap
Pillar 4: ICT Third-Party Risk Management
DORA Articles 28–44 are the most operationally complex pillar. Key gap analysis questions:
- Do you maintain a register of all ICT third-party service providers with criticality ratings?
- Have you identified critical third-party providers and conducted enhanced due diligence?
- Have you assessed concentration risk from reliance on single cloud or technology providers?
- Do your ICT contracts include DORA Article 30 mandatory provisions (incident notification, audit rights, exit plans)?
- Do you have documented exit plans for all critical third-party providers?
- Gap indicator: If your ICT provider contracts do not include incident notification SLAs and exit strategy provisions, Pillar 4 has material contractual gaps
Pillar 5: Information Sharing
DORA Article 45 encourages voluntary information sharing on cyber threat intelligence. While voluntary, participation demonstrates engagement with the DORA framework:
- Are you a member of any sector-specific threat intelligence sharing arrangement (FS-ISAC, NCSC sharing schemes)?
- Do you have procedures for receiving, assessing, and acting on threat intelligence from information sharing networks?
- Gap indicator: Non-participation in any information sharing is not a compliance breach but represents a missed resilience enhancement
Frequently Asked Questions
How long does a DORA gap analysis take?
A structured DORA gap analysis using this template takes 2–4 weeks for a typical financial firm — longer for complex, multi-entity groups. The analysis requires input from IT, compliance, procurement (for contract review), and senior management (for governance documentation). Kyanite Blue can conduct a facilitated DORA gap analysis, typically completing the assessment in 2–3 weeks with a structured remediation roadmap delivered within four weeks of starting.
Should we prioritise DORA or FCA PS21/3 if we have limited capacity?
For UK firms with EU exposure, DORA takes priority for EU-facing entities — it is a direct legal obligation. For the UK entity, PS21/3 is the primary obligation. Where the frameworks overlap (and they overlap significantly in ICT risk management, incident response, and third-party risk), addressing the more prescriptive DORA requirement typically satisfies both. For firms without EU exposure, PS21/3 is the only direct obligation, but DORA provides a useful benchmark for what comprehensive resilience looks like.
What is the biggest DORA compliance gap for most UK firms?
In our experience, the most common material gap is ICT third-party contracts — specifically, the absence of DORA Article 30 mandatory provisions. Most firms have ICT contracts that were negotiated before DORA and do not include incident notification timelines, security standards, audit rights, and exit strategy provisions. Contract renegotiation with major providers (cloud, core banking, trading systems) takes time — this is the gap to start addressing first, as it requires external engagement and procurement lead time.
Commission a facilitated DORA gap analysis
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.